Assigning Profiles (SAP Library - Users and Roles (BC-CCM-USR))

Assigning Profiles

You assign authorization profiles to a user in the Profiles tab.

You can assign a large number of authorization profiles to a user (about 150).

Profiles give users authorizations.

You should maintain your profiles in the role maintenance transaction PFCG unless you have to edit profiles that were created manually.

You can manually maintain profiles by choosing Tools ® Administration ® Manual maintenance ® Edit profiles manually (see Creating and Maintaining Authorizations and Profiles Manually). You can also enter composite profiles (a combination of several profiles) in the user master records when manually maintaining profiles.

If you choose automatic maintenance, the Profile Generator generates an authorization profile on the basis of an role.

You can go to role maintenance and profile generation from the user maintenance with Environment ® Maintain roles. See Role maintenance.

You assign roles to a user in the Roles tab. This simultaneously assigns the associated authorization profiles to the user. See Assigning roles and Comparing profiles with roles in the user master record sapurl_link_0009_0004_0007 .

Never insert profiles generated in the role maintenance directly into the user master record. The profiles are automatically transferred to your user master record after a user comparison in the Profile Generator.

The SAP System contains predefined profiles:

SAP_ALL: assign the profile SAP_ALL to users who are to have all R/3 authorizations including superuser authorization.
SAP_NEW: assign this profile to users who are to have access to all not yet protected components.

The SAP_NEW profile grants unrestricted access to all existing functions for which additional authorization checks have been introduced. Users can therefore continue to work uninterrupted with functions which are subject to new authorization checks. This ensures upward compatibility.

For this reason you should assign SAP_NEW to all user master records. You can then decide which users are to have which authorizations and delete the SAP_NEW profile.

If you have skipped releases or upgrades, when you execute this operation you need to take into account all authorizations which have come into the system in the meantime. SAP_NEW is a composite profile which contains a simple profile S_NEW_<Release> with new authorizations for functional Releases.

You must add the new authorizations to manually generated profiles
Following a Release or upgrade you need to regenerate all authorization profiles which have been generated using the Profile Generator. Choose Environment ® Installation/Upgrade in the role maintenance (transaction SU25).